This is an example Terraform configuration to automatically initialize Vault and unseal it through Terraform. NOTE: This will store unseal keys and root token in the Terraform state. Highly recommend manually rotating unseal keys and root token after additional Vault configs have been deployed.

vault-operator-init-unseal.tf

terraform {
  required_providers {
    terracurl = {
      source  = "devops-rob/terracurl"
      version = "~> 1.2"
    }
  }
}

provider "terracurl" {}

variable "address" {
  type    = string
  default = "http://localhost:8200"
}

variable "keys" {
  type    = number
  default = 3
}

variable "threshold" {
  type    = number
  default = 2
}

resource "terracurl_request" "init" {
  name   = "init"
  url    = "${var.address}/v1/sys/init"
  method = "POST"

  request_body = jsonencode({
    secret_shares    = var.keys
    secret_threshold = var.threshold
  })

  response_codes = [200]
}

resource "terracurl_request" "unseal" {
  count = var.threshold

  name   = "unseal-${count.index}"
  url    = "${var.address}/v1/sys/unseal"
  method = "POST"

  request_body = jsonencode({
    key = jsondecode(terracurl_request.init.response).keys[count.index]
  })

  response_codes = [200]
}